Retrieve an inbox
The lease, the message count and the extensions left. The state a client draws around the list.
Runs the real call against your workspace, with your own key.
GET /temp-mail/inboxes/{id}
The lease, the message count and the extensions left. The state a client draws around the list.
The inbox token
export OE=https://api.openemail.ukexport INBOX="Authorization: Bearer oe_inbox_kQ8v…"Every call below carries the token POST /temp-mail/inboxes returned, in the same Authorization: Bearer header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.
The id in the path has to name the same inbox the token does. The token alone identifies one, so this is belt and braces, but it means a caller that muddles two inboxes gets a 404 instead of quietly reading the wrong mail.
Example
Cheap: one indexed row and no object storage. Poll the message list instead if what you want is mail. That call carries the expiry too.
curl "$OE/temp-mail/inboxes/tinb_9c2f41ab7d3e4c118a0f5d72" -H "$INBOX"{ "object": "temp_inbox", "id": "tinb_9c2f41ab7d3e4c118a0f5d72", "address": "[email protected]", "domain": "freemailaddress.com", "createdAt": "2026-09-01T10:00:00.000Z", "expiresAt": "2026-09-01T12:00:00.000Z", "extensionsLeft": 22, "messageCount": 3, "messageLimit": 50, "lastMessageAt": "2026-09-01T10:31:04.000Z"}An expired, destroyed or unknown inbox is one answer: 404. "Your lease ran out", "that is not yours" and "that never existed" are indistinguishable from outside on purpose, and the mailbox refuses to distinguish them for the same reason.